chore: enhance PR validation workflow with coverage check [SD-331] - #1024
Closed
caio-pizzol wants to merge 12 commits into
Closed
chore: enhance PR validation workflow with coverage check [SD-331]#1024caio-pizzol wants to merge 12 commits into
caio-pizzol wants to merge 12 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // Get changed files | ||
| const baseRef = process.env.BASE_REF; | ||
| const changedFiles = execSync(`git diff --name-only --diff-filter=ACMR origin/${baseRef}...HEAD`) |
Check warning
Code scanning / CodeQL
Indirect uncontrolled command line Medium
harbournick
changed the title
superdoc-bot Bot
pushed a commit
that referenced
this pull request
Jul 29, 2026
![superdoc-oss-port[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…#1024) * fix(catalog): run slug validation when the baseline itself changes The published-slug baseline is half of the permanence rule, but no workflow watched it. A PR touching only go-links/published-slugs.json ran no catalog validation at all, so an entry could be removed from the baseline without review, and a later PR could then drop the matching manifest slug against an already weakened baseline. Each step looks harmless; together they retire a live URL. The validator does catch the mismatch, so this is not a hole in the check. It is a check that never fired. A test asserts the workflow triggers on every file the slug rule depends on, since a missing path filter has no symptom until the day it matters. * feat(catalog): make slug validation a required, locally runnable lane The slug baseline only protects public URLs if the check that reads it actually runs. It was not a required check, so a pull request touching a manifest could merge without it, which made the whole permanence contract advisory. Adding it to the rulesets alone would have made things worse. The workflow filtered on `on.paths`, so it never reported on unrelated changes, and a required check that never reports blocks the pull request forever. It now runs on every pull request and in the merge queue, with a `detect` job deciding whether the real work is needed and a `validate` job that reports either way. That is the pattern ci-examples and ci-document-api already use, for the same reason. The policy also refuses `branchProtection` without a local lane, which is a good rule: a check people cannot reproduce locally is one they can only argue with. So there is now a `ci-catalog` lane, reachable through `pnpm superdoc:gate --lane ci-catalog`. It is the cheapest lane here -- reads JSON, compares it, no build or network -- so local and CI results cannot diverge, and it runs first because it fails fastest. Two lane rosters in the tests were hardcoded and are updated. Adding the context to require-ci and require-ci-v2 is the remaining step, and is a repository settings change. * refactor(catalog): drop the dependency install the lane never needed The lane described itself as network-free while its first stage ran `pnpm install --frozen-lockfile`, which is the one step in it that touches the network and can differ between machines. Both commands import only `node:` builtins, and both were verified to run with `node_modules` absent, so the install was doing nothing. Removed from the lane and from the workflow together: a lane that diverges from its CI counterpart is worse than no lane, because it teaches people the wrong thing about what CI will do. The environment note now says what is actually true rather than claiming local and CI cannot diverge, which was stronger than the evidence. Note: this ports only the public subtree changes from a mixed source commit (1 public path, 5 non-public paths ignored). Ported-From-Source-Repo: superdoc/orbit Ported-From-Source-Commit: 1d19965b10036f51bc2c3553f2ceda61a0d18132 Ported-Public-Prefix: superdoc/public
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.